From 26579dd59fe8a42f62de95b6dcc6b09b5b4f42fe Mon Sep 17 00:00:00 2001 From: Tuan Pham Ngoc Date: Sun, 21 Mar 2021 16:48:58 +0700 Subject: [PATCH 01/17] Allow manager to edit account via com_users --- .../src/Controller/UserController.php | 39 +++++++++++++++ .../com_users/src/Dispatcher/Dispatcher.php | 50 +++++++++++++++++++ 2 files changed, 89 insertions(+) create mode 100644 administrator/components/com_users/src/Dispatcher/Dispatcher.php diff --git a/administrator/components/com_users/src/Controller/UserController.php b/administrator/components/com_users/src/Controller/UserController.php index 2b29efc30708a..eebb26677690d 100644 --- a/administrator/components/com_users/src/Controller/UserController.php +++ b/administrator/components/com_users/src/Controller/UserController.php @@ -53,6 +53,13 @@ protected function allowEdit($data = array(), $key = 'id') } } + // Check if user is editing his account, if Yes, allow him to edit + if (isset($data[$key]) && $this->app->getIdentity()->id == $data['id']) + { + + return true; + } + return parent::allowEdit($data, $key); } @@ -85,6 +92,38 @@ public function cancel($key = null) return $result; } + /** + * Override parent cancel to redirect when using status edit account. + * + * @param string $key The name of the primary key of the URL variable. + * @param string $urlVar The name of the URL variable if different from the primary key (sometimes required to avoid router collisions). + * + * @return boolean True if successful, false otherwise. + * + * @since 1.6 + */ + public function save($key = null, $urlVar = null) + { + $result = parent::save($key, $urlVar); + + $task = $this->getTask(); + + if ($task === 'save' && $return = $this->input->get('return', '', 'BASE64')) + { + $return = base64_decode($return); + + // Don't redirect to an external URL. + if (!Uri::isInternal($return)) + { + $return = Uri::base(); + } + + $this->setRedirect($return); + } + + return $result; + } + /** * Method to run batch operations. * diff --git a/administrator/components/com_users/src/Dispatcher/Dispatcher.php b/administrator/components/com_users/src/Dispatcher/Dispatcher.php new file mode 100644 index 0000000000000..718071d0b61d3 --- /dev/null +++ b/administrator/components/com_users/src/Dispatcher/Dispatcher.php @@ -0,0 +1,50 @@ + + * @license GNU General Public License version 2 or later; see LICENSE.txt + */ + +namespace Joomla\Component\Users\Administrator\Dispatcher; + +\defined('_JEXEC') or die; + +use Joomla\CMS\Dispatcher\ComponentDispatcher; + +/** + * ComponentDispatcher class for com_admin + * + * @since 4.0.0 + */ +class Dispatcher extends ComponentDispatcher +{ + /** + * com_admin does not require check permission, so we override checkAccess method and have it empty + * + * @return void + */ + protected function checkAccess() + { + $task = $this->input->getCmd('task'); + $view = $this->input->getCmd('view'); + $layout = $this->input->getCmd('layout'); + $allowedTasks = ['user.edit', 'user.apply', 'user.save', 'user.cancel']; + + // Allow user to edit data from his own account + if (in_array($task, $allowedTasks) || ($view === 'user' && $layout == 'edit')) + { + + $user = $this->app->getIdentity(); + $id = $this->input->getInt('id'); + + if ($user->id == $id) + { + return; + } + } + + parent::checkAccess(); + } +} From 01f85166ce962dffde755b0b2fba74d3401b790c Mon Sep 17 00:00:00 2001 From: Tuan Pham Ngoc Date: Sun, 21 Mar 2021 16:53:33 +0700 Subject: [PATCH 02/17] Update edit links --- administrator/modules/mod_user/tmpl/default.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/administrator/modules/mod_user/tmpl/default.php b/administrator/modules/mod_user/tmpl/default.php index 55c65ea1447d7..e8d4e27066434 100644 --- a/administrator/modules/mod_user/tmpl/default.php +++ b/administrator/modules/mod_user/tmpl/default.php @@ -37,12 +37,12 @@ name); ?> - id . '&return=' . base64_encode($uri) . '#attrib-user_details'; ?> + id . '&return=' . base64_encode($uri) . '#attrib-user_details'; ?> - id . '&return=' . base64_encode($uri) . '#attrib-accessibility'; ?> + id . '&return=' . base64_encode($uri) . '#attrib-accessibility'; ?> From e309c415e8b56f8b3543bf2f4c19f3a9ffdc32eb Mon Sep 17 00:00:00 2001 From: Tuan Pham Ngoc Date: Sun, 21 Mar 2021 19:42:18 +0700 Subject: [PATCH 03/17] Show save button in case user editing his own account --- administrator/components/com_users/src/View/User/HtmlView.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/administrator/components/com_users/src/View/User/HtmlView.php b/administrator/components/com_users/src/View/User/HtmlView.php index 79b345883e2f7..8c67309df88fe 100644 --- a/administrator/components/com_users/src/View/User/HtmlView.php +++ b/administrator/components/com_users/src/View/User/HtmlView.php @@ -144,7 +144,7 @@ protected function addToolbar() $toolbarButtons = []; - if ($canDo->get('core.edit') || $canDo->get('core.create')) + if ($canDo->get('core.edit') || $canDo->get('core.create') || $isProfile) { ToolbarHelper::apply('user.apply'); $toolbarButtons[] = ['save', 'user.save']; From e95aa11f53536a82c772432a25252544320785a8 Mon Sep 17 00:00:00 2001 From: Tuan Pham Ngoc Date: Sun, 21 Mar 2021 19:47:11 +0700 Subject: [PATCH 04/17] CS --- .../components/com_users/src/Controller/UserController.php | 5 ++--- .../components/com_users/src/Dispatcher/Dispatcher.php | 3 +-- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/administrator/components/com_users/src/Controller/UserController.php b/administrator/components/com_users/src/Controller/UserController.php index eebb26677690d..001b119ef03fd 100644 --- a/administrator/components/com_users/src/Controller/UserController.php +++ b/administrator/components/com_users/src/Controller/UserController.php @@ -53,10 +53,9 @@ protected function allowEdit($data = array(), $key = 'id') } } - // Check if user is editing his account, if Yes, allow him to edit + // Allow user to edit his profile if (isset($data[$key]) && $this->app->getIdentity()->id == $data['id']) { - return true; } @@ -93,7 +92,7 @@ public function cancel($key = null) } /** - * Override parent cancel to redirect when using status edit account. + * Override parent save to redirect when using status edit account. * * @param string $key The name of the primary key of the URL variable. * @param string $urlVar The name of the URL variable if different from the primary key (sometimes required to avoid router collisions). diff --git a/administrator/components/com_users/src/Dispatcher/Dispatcher.php b/administrator/components/com_users/src/Dispatcher/Dispatcher.php index 718071d0b61d3..f31ba7177c323 100644 --- a/administrator/components/com_users/src/Dispatcher/Dispatcher.php +++ b/administrator/components/com_users/src/Dispatcher/Dispatcher.php @@ -1,7 +1,7 @@ * @license GNU General Public License version 2 or later; see LICENSE.txt @@ -35,7 +35,6 @@ protected function checkAccess() // Allow user to edit data from his own account if (in_array($task, $allowedTasks) || ($view === 'user' && $layout == 'edit')) { - $user = $this->app->getIdentity(); $id = $this->input->getInt('id'); From 2c6d7fb33925744c8a2949968832b5a2d6ba1c6e Mon Sep 17 00:00:00 2001 From: Tuan Pham Ngoc Date: Sun, 21 Mar 2021 19:52:01 +0700 Subject: [PATCH 05/17] Correct comment --- .../components/com_users/src/Dispatcher/Dispatcher.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/administrator/components/com_users/src/Dispatcher/Dispatcher.php b/administrator/components/com_users/src/Dispatcher/Dispatcher.php index f31ba7177c323..f69c1ee3caadb 100644 --- a/administrator/components/com_users/src/Dispatcher/Dispatcher.php +++ b/administrator/components/com_users/src/Dispatcher/Dispatcher.php @@ -21,7 +21,7 @@ class Dispatcher extends ComponentDispatcher { /** - * com_admin does not require check permission, so we override checkAccess method and have it empty + * Override checkAccess to allow users edit profile without having to have core.manager permission * * @return void */ From f6b4b92b7c3650082133cef62abd5e921d75a719 Mon Sep 17 00:00:00 2001 From: Tuan Pham Ngoc Date: Sun, 21 Mar 2021 20:00:27 +0700 Subject: [PATCH 06/17] Use $key instead of hardcode 'id' --- .../components/com_users/src/Controller/UserController.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/administrator/components/com_users/src/Controller/UserController.php b/administrator/components/com_users/src/Controller/UserController.php index 001b119ef03fd..5c7d40440bb77 100644 --- a/administrator/components/com_users/src/Controller/UserController.php +++ b/administrator/components/com_users/src/Controller/UserController.php @@ -54,7 +54,7 @@ protected function allowEdit($data = array(), $key = 'id') } // Allow user to edit his profile - if (isset($data[$key]) && $this->app->getIdentity()->id == $data['id']) + if (isset($data[$key]) && $this->app->getIdentity()->id == $data[$key]) { return true; } From 245712cdb18986472d931ec8de95bd0122a6026f Mon Sep 17 00:00:00 2001 From: Tuan Pham Ngoc Date: Sun, 21 Mar 2021 20:52:58 +0700 Subject: [PATCH 07/17] Correct @since tag --- .../components/com_users/src/Controller/UserController.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/administrator/components/com_users/src/Controller/UserController.php b/administrator/components/com_users/src/Controller/UserController.php index 5c7d40440bb77..61c8103627272 100644 --- a/administrator/components/com_users/src/Controller/UserController.php +++ b/administrator/components/com_users/src/Controller/UserController.php @@ -39,7 +39,7 @@ class UserController extends FormController * * @return boolean True if allowed, false otherwise. * - * @since 1.6 + * @since __DEPLOY_VERSION__ */ protected function allowEdit($data = array(), $key = 'id') { From c0bfbf40537ba8dc9bcc584d82fe4ed279088e53 Mon Sep 17 00:00:00 2001 From: Tuan Pham Ngoc Date: Sun, 21 Mar 2021 20:57:30 +0700 Subject: [PATCH 08/17] Correct @since --- .../components/com_users/src/Controller/UserController.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/administrator/components/com_users/src/Controller/UserController.php b/administrator/components/com_users/src/Controller/UserController.php index 61c8103627272..af7398f9a7b58 100644 --- a/administrator/components/com_users/src/Controller/UserController.php +++ b/administrator/components/com_users/src/Controller/UserController.php @@ -39,7 +39,7 @@ class UserController extends FormController * * @return boolean True if allowed, false otherwise. * - * @since __DEPLOY_VERSION__ + * @since 1.6 */ protected function allowEdit($data = array(), $key = 'id') { @@ -99,7 +99,7 @@ public function cancel($key = null) * * @return boolean True if successful, false otherwise. * - * @since 1.6 + * @since __DEPLOY_VERSION__ */ public function save($key = null, $urlVar = null) { From 6dbb7aa7e3bd89bcd9d20b52021fb9c74a82b1d3 Mon Sep 17 00:00:00 2001 From: Tuan Pham Ngoc Date: Sun, 21 Mar 2021 21:06:59 +0700 Subject: [PATCH 09/17] CS --- .../components/com_users/src/Dispatcher/Dispatcher.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/administrator/components/com_users/src/Dispatcher/Dispatcher.php b/administrator/components/com_users/src/Dispatcher/Dispatcher.php index f69c1ee3caadb..fe28a85c53856 100644 --- a/administrator/components/com_users/src/Dispatcher/Dispatcher.php +++ b/administrator/components/com_users/src/Dispatcher/Dispatcher.php @@ -14,9 +14,9 @@ use Joomla\CMS\Dispatcher\ComponentDispatcher; /** - * ComponentDispatcher class for com_admin + * ComponentDispatcher class for com_users * - * @since 4.0.0 + * @since __DEPLOY_VERSION__ */ class Dispatcher extends ComponentDispatcher { From 9b3a9b84ed6e8fa9b75e431f0f34bc94da7efdf1 Mon Sep 17 00:00:00 2001 From: Tuan Pham Ngoc Date: Tue, 23 Mar 2021 13:23:27 +0700 Subject: [PATCH 10/17] Correct comments --- .../components/com_users/src/Controller/UserController.php | 2 +- .../components/com_users/src/Dispatcher/Dispatcher.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/administrator/components/com_users/src/Controller/UserController.php b/administrator/components/com_users/src/Controller/UserController.php index af7398f9a7b58..88a488de8055b 100644 --- a/administrator/components/com_users/src/Controller/UserController.php +++ b/administrator/components/com_users/src/Controller/UserController.php @@ -53,7 +53,7 @@ protected function allowEdit($data = array(), $key = 'id') } } - // Allow user to edit his profile + // Allow users to edit their own account if (isset($data[$key]) && $this->app->getIdentity()->id == $data[$key]) { return true; diff --git a/administrator/components/com_users/src/Dispatcher/Dispatcher.php b/administrator/components/com_users/src/Dispatcher/Dispatcher.php index fe28a85c53856..ae27eb40b2fe2 100644 --- a/administrator/components/com_users/src/Dispatcher/Dispatcher.php +++ b/administrator/components/com_users/src/Dispatcher/Dispatcher.php @@ -32,7 +32,7 @@ protected function checkAccess() $layout = $this->input->getCmd('layout'); $allowedTasks = ['user.edit', 'user.apply', 'user.save', 'user.cancel']; - // Allow user to edit data from his own account + // Allow users to edit their own account if (in_array($task, $allowedTasks) || ($view === 'user' && $layout == 'edit')) { $user = $this->app->getIdentity(); From 872c10890882439c048b57e34caf2a2301a54e82 Mon Sep 17 00:00:00 2001 From: Tuan Pham Ngoc Date: Wed, 24 Mar 2021 14:44:26 +0700 Subject: [PATCH 11/17] Update administrator/components/com_users/src/Dispatcher/Dispatcher.php Co-authored-by: Tobias Zulauf --- .../components/com_users/src/Dispatcher/Dispatcher.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/administrator/components/com_users/src/Dispatcher/Dispatcher.php b/administrator/components/com_users/src/Dispatcher/Dispatcher.php index ae27eb40b2fe2..a6a0ccf9bfd9b 100644 --- a/administrator/components/com_users/src/Dispatcher/Dispatcher.php +++ b/administrator/components/com_users/src/Dispatcher/Dispatcher.php @@ -3,7 +3,7 @@ * @package Joomla.Administrator * @subpackage com_users * - * @copyright (C) 2017 Open Source Matters, Inc. + * @copyright (C) 2021 Open Source Matters, Inc. * @license GNU General Public License version 2 or later; see LICENSE.txt */ From 2b6f50ef542e53a2fef53130331238f65ebc1bb7 Mon Sep 17 00:00:00 2001 From: Tuan Pham Ngoc Date: Wed, 24 Mar 2021 14:44:40 +0700 Subject: [PATCH 12/17] Update administrator/components/com_users/src/Dispatcher/Dispatcher.php Co-authored-by: Tobias Zulauf --- .../components/com_users/src/Dispatcher/Dispatcher.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/administrator/components/com_users/src/Dispatcher/Dispatcher.php b/administrator/components/com_users/src/Dispatcher/Dispatcher.php index a6a0ccf9bfd9b..38313a4225e54 100644 --- a/administrator/components/com_users/src/Dispatcher/Dispatcher.php +++ b/administrator/components/com_users/src/Dispatcher/Dispatcher.php @@ -24,6 +24,8 @@ class Dispatcher extends ComponentDispatcher * Override checkAccess to allow users edit profile without having to have core.manager permission * * @return void + * + * @since __DEPLOY_VERSION__ */ protected function checkAccess() { From c8da777c350cd16cf1da2ea37e9eded75a789444 Mon Sep 17 00:00:00 2001 From: Tuan Pham Ngoc Date: Wed, 24 Mar 2021 14:51:00 +0700 Subject: [PATCH 13/17] Update administrator/components/com_users/src/Dispatcher/Dispatcher.php Co-authored-by: Tobias Zulauf --- .../components/com_users/src/Dispatcher/Dispatcher.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/administrator/components/com_users/src/Dispatcher/Dispatcher.php b/administrator/components/com_users/src/Dispatcher/Dispatcher.php index 38313a4225e54..7adca01bb2121 100644 --- a/administrator/components/com_users/src/Dispatcher/Dispatcher.php +++ b/administrator/components/com_users/src/Dispatcher/Dispatcher.php @@ -40,7 +40,7 @@ protected function checkAccess() $user = $this->app->getIdentity(); $id = $this->input->getInt('id'); - if ($user->id == $id) + if ($user->id === $id) { return; } From 268d19ad6bfcbb401470df95cfbf28c451bc04ac Mon Sep 17 00:00:00 2001 From: Tuan Pham Ngoc Date: Wed, 24 Mar 2021 14:51:07 +0700 Subject: [PATCH 14/17] Update administrator/components/com_users/src/Controller/UserController.php Co-authored-by: Tobias Zulauf --- .../components/com_users/src/Controller/UserController.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/administrator/components/com_users/src/Controller/UserController.php b/administrator/components/com_users/src/Controller/UserController.php index 88a488de8055b..34ea4b2a3041a 100644 --- a/administrator/components/com_users/src/Controller/UserController.php +++ b/administrator/components/com_users/src/Controller/UserController.php @@ -54,7 +54,7 @@ protected function allowEdit($data = array(), $key = 'id') } // Allow users to edit their own account - if (isset($data[$key]) && $this->app->getIdentity()->id == $data[$key]) + if (isset($data[$key]) && $this->app->getIdentity()->id === (int) $data[$key]) { return true; } From 2e92be8bd6ee04d386f470166884e8e85d978d0c Mon Sep 17 00:00:00 2001 From: Tuan Pham Ngoc Date: Wed, 24 Mar 2021 14:52:48 +0700 Subject: [PATCH 15/17] CS --- .../components/com_users/src/Dispatcher/Dispatcher.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/administrator/components/com_users/src/Dispatcher/Dispatcher.php b/administrator/components/com_users/src/Dispatcher/Dispatcher.php index 7adca01bb2121..a97037ff30693 100644 --- a/administrator/components/com_users/src/Dispatcher/Dispatcher.php +++ b/administrator/components/com_users/src/Dispatcher/Dispatcher.php @@ -24,8 +24,8 @@ class Dispatcher extends ComponentDispatcher * Override checkAccess to allow users edit profile without having to have core.manager permission * * @return void - * - * @since __DEPLOY_VERSION__ + * + * @since __DEPLOY_VERSION__ */ protected function checkAccess() { From 688f66a57ad9dab25d64364bf0ca17e23e67e63b Mon Sep 17 00:00:00 2001 From: Tuan Pham Ngoc Date: Wed, 24 Mar 2021 22:13:52 +0700 Subject: [PATCH 16/17] Update administrator/components/com_users/src/Controller/UserController.php Co-authored-by: Quy --- .../components/com_users/src/Controller/UserController.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/administrator/components/com_users/src/Controller/UserController.php b/administrator/components/com_users/src/Controller/UserController.php index 34ea4b2a3041a..b99b0c3d35bfa 100644 --- a/administrator/components/com_users/src/Controller/UserController.php +++ b/administrator/components/com_users/src/Controller/UserController.php @@ -105,7 +105,7 @@ public function save($key = null, $urlVar = null) { $result = parent::save($key, $urlVar); - $task = $this->getTask(); + $task = $this->getTask(); if ($task === 'save' && $return = $this->input->get('return', '', 'BASE64')) { From 3466c1937b9fdf2e33a68a5fc919fab447714655 Mon Sep 17 00:00:00 2001 From: Tuan Pham Ngoc Date: Thu, 25 Mar 2021 11:54:32 +0700 Subject: [PATCH 17/17] Fix error with PDF --- .../components/com_users/src/Controller/UserController.php | 2 +- .../components/com_users/src/Dispatcher/Dispatcher.php | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/administrator/components/com_users/src/Controller/UserController.php b/administrator/components/com_users/src/Controller/UserController.php index 34ea4b2a3041a..560a443366d24 100644 --- a/administrator/components/com_users/src/Controller/UserController.php +++ b/administrator/components/com_users/src/Controller/UserController.php @@ -54,7 +54,7 @@ protected function allowEdit($data = array(), $key = 'id') } // Allow users to edit their own account - if (isset($data[$key]) && $this->app->getIdentity()->id === (int) $data[$key]) + if (isset($data[$key]) && (int) $this->app->getIdentity()->id === (int) $data[$key]) { return true; } diff --git a/administrator/components/com_users/src/Dispatcher/Dispatcher.php b/administrator/components/com_users/src/Dispatcher/Dispatcher.php index a97037ff30693..55d0cb0308ef0 100644 --- a/administrator/components/com_users/src/Dispatcher/Dispatcher.php +++ b/administrator/components/com_users/src/Dispatcher/Dispatcher.php @@ -35,12 +35,12 @@ protected function checkAccess() $allowedTasks = ['user.edit', 'user.apply', 'user.save', 'user.cancel']; // Allow users to edit their own account - if (in_array($task, $allowedTasks) || ($view === 'user' && $layout == 'edit')) + if (in_array($task, $allowedTasks, true) || ($view === 'user' && $layout === 'edit')) { $user = $this->app->getIdentity(); $id = $this->input->getInt('id'); - if ($user->id === $id) + if ((int) $user->id === $id) { return; }